Certified Kubernetes Application Developer (CKAD)

Correct answer: C. Create a Service of type ExternalName with the externalName field set to 'prod-db-99.provider.com'.

An ExternalName Service creates a DNS CNAME record, perfectly mapping an internal cluster domain to an external FQDN without code changes. Modifying CoreDNS directly is an anti-pattern and a poor distractor, whereas Ingress only manages HTTP traffic routing.

Correct answer: D. Define a livenessProbe using an exec command that evaluates the file's modification time

A liveness probe determines when a container needs a restart due to deadlock or failure. Using an exec handler runs a custom script to validate complex conditions, such as file modification times, which readiness probes or startup delays do not manage.

Correct answer: B. Set completions to 100, parallelism to 10, backoffLimit to 4, and activeDeadlineSeconds to 1800

In Kubernetes Jobs, backoffLimit governs the maximum pod retries before failing. The activeDeadlineSeconds parameter enforces a strict time limit for the entire job execution. Avoid sidecar workarounds and use native API fields during the exam.

Correct answer: D. Configure the Pod specification to use the Downward API to map fieldRef values like metadata.name and spec.nodeName into environment variables.

The Downward API exposes pod metadata directly to containers without using the Kubernetes API client. Use fieldRef for environment variables to pass the pod name and node name dynamically. Static ConfigMaps fail when pods are rescheduled.

Correct answer: B. Define the strategy with maxUnavailable set to 0 and maxSurge set to 2 to maintain at least 6 pods while allowing a maximum of 8 pods during the transition.

Setting maxUnavailable to zero keeps all desired replicas running during updates. Configuring maxSurge to two allows only two extra pods to be created, keeping the maximum total within the required limit. The Recreate strategy causes downtime.

Correct answer: B. Apply a volumeMount with the subPath property to map the specific key from the ConfigMap volume directly to the desired file path in the container.

The subPath property mounts a single file from a volume into an existing directory without obscuring other files. This is the exact Kubernetes feature for injecting specific ConfigMap keys safely. Using init containers is an unnecessary workaround.

Correct answer: A. Specify fsGroup: 2000 within the Pod-level securityContext to automatically change the ownership of the mounted volume to be owned by group 2000.

Specifying fsGroup in the Pod securityContext automatically adjusts the group ownership of mounted volumes. This built-in kubelet feature handles permissions cleanly, avoiding the need for insecure privileged containers or application modifications.

Correct answer: B. Define an Init container that runs a script to check for the availability of the 'db-backend' service using a tool like netcat or nslookup.

Init containers run sequentially and must complete successfully before the main application containers start. This makes them the perfect tool for blocking startup until external network dependencies are fully reachable and ready.

Correct answer: B. Implement a LivenessProbe using an HTTP GET request with an initialDelaySeconds of 30 and a failureThreshold of 3.

A LivenessProbe detects application deadlocks and restarts the unresponsive container to restore functionality. The initialDelaySeconds parameter ensures the probe does not prematurely kill the container during its 30-second startup routine.

Correct answer: B. Set an ephemeral-storage resource limit of 500Mi within the container specification

Setting an ephemeral-storage limit triggers pod eviction when container writes exceed the specified threshold, protecting the node. ResourceQuotas only cap total namespace usage rather than enforcing strict limits on individual pod consumption.

Correct answer: D. Implement a projected volume that includes secret, configMap, and downwardAPI sources

A projected volume maps several volume sources like secrets and downwardAPI data into a single unified directory tree. This provides a clean aggregation method, whereas overlapping standard volume mounts will simply overwrite each other.

Correct answer: C. Define a readinessProbe using httpGet specifying port 9090 and the appropriate path for health checks.

A readinessProbe using httpGet on the management port accurately validates application readiness before routing traffic. Liveness or startup probes do not control traffic routing, making them unsuitable for this specific Service requirement.

Correct answer: D. Set the boolean field automountServiceAccountToken to false in the Pod specification to prevent the automatic mount.

Setting automountServiceAccountToken to false explicitly stops the kubelet from injecting the API credentials into the pod. Overriding the mount path with an emptyDir is a dangerous hack that does not properly secure the environment.

Correct answer: B. A Headless Service with the clusterIP field set to None and a selector that matches the labels defined in the StatefulSet's pod template.

A Headless Service returns individual pod IP addresses instead of providing a single virtual IP for load balancing. This behavior is required for StatefulSets to provide stable network identities for distributed data replication.

Correct answer: C. Define backoffLimit set to 4 and activeDeadlineSeconds set to 300

The backoffLimit field specifies the number of retries before a Job is marked as failed, while activeDeadlineSeconds enforces a hard time limit. Use activeDeadlineSeconds rather than a grace period when you need an absolute cap on Job duration.

Correct answer: C. Change the Deployment strategy type to Recreate in the spec section

The Recreate deployment strategy terminates all existing Pods before creating new ones, which is required for singleton applications. A RollingUpdate will temporarily run both versions simultaneously, risking database locks.

Correct answer: A. Configure topologySpreadConstraints in the Pod spec with a topologyKey set to 'topology.kubernetes.io/zone' and a maxSkew of 1.

TopologySpreadConstraints give the scheduler explicit rules for distributing Pods evenly across designated topology domains like zones. NodeSelectors or anti-affinity rules cannot mathematically enforce an even spread across multiple failure domains.

Correct answer: B. Define a Readiness Probe using the exec handler to run the /usr/bin/verify-dependencies.sh script to control the Pod's inclusion in Service endpoints.

A Readiness Probe evaluates if an application can serve requests, removing it from Service endpoints if checks fail. A Liveness Probe would restart the Pod unnecessarily when external dependencies become temporarily unavailable.

Correct answer: C. Modify the label selector of the 'checkout-service' to match the unique labels of the Version 2 Deployment pods.

Updating the Service selector instantly changes traffic routing to match the new deployment pods. Deleting the old deployment removes rollback capability, and Ingress canary rules apply proxy traffic splitting, not standard Kubernetes service routing.

Correct answer: C. A Headless Service with the 'clusterIP' set to 'None' and matching the 'serviceName' of the StatefulSet

A Headless Service with clusterIP set to None provides stable DNS records for individual StatefulSet pods. Standard ClusterIP services balance traffic across random pods, destroying direct addressability, while Ingress and LoadBalancers manage external routing.

Correct answer: B. Implement an initContainer that uses a specialized image containing the tools to generate the key and save it into an emptyDir volume shared with the main container.

Init containers run sequentially before the main app, securely passing data via an emptyDir volume. Granting elevated runtime capabilities or relying on lifecycle hooks leaves heavy diagnostic tools exposed inside the primary production image.

Correct answer: B. Define an Init Container that runs the SQL validation script and only exits successfully when the database schema version is confirmed as 2.4.

Init containers block application startup until prerequisite checks successfully complete. PostStart hooks execute concurrently with the main app, and readiness probes only prevent service routing without stopping the main process from crashing.

Correct answer: B. Set maxSurge to 20% and maxUnavailable to 20%

A twenty percent surge permits exactly two extra pods, staying safely under the twelve pod limit. Concurrently, twenty percent unavailable ensures at least eight pods remain active, perfectly meeting the strict availability requirements.

Correct answer: D. Apply a NetworkPolicy with an 'egress' section that includes a CIDR rule for 10.0.0.55/32 and a rule for the DNS port.

A NetworkPolicy with an egress section explicitly allows traffic to the database IP and DNS port while blocking everything else. RBAC controls API access rather than network traffic, and Ingress only manages incoming connections.

Correct answer: D. Apply a Taint with the NoSchedule effect to the GPU nodes and add a matching Toleration and NodeAffinity to the fraud-detection Pod specification.

Taints repel standard Pods from the GPU nodes, while Tolerations and NodeAffinity ensure the fraud-detection Pods are specifically scheduled there. Using NodeAffinity guarantees the workload lands on the correct hardware.

Correct answer: A. Add a Startup probe with a failureThreshold of 30 and a periodSeconds of 10 to allow the container up to 300 seconds to initialize before Liveness probes take over.

A Startup probe disables Liveness and Readiness checks until it succeeds, protecting slow-starting applications. Just increasing the Liveness delay leaves the container unmonitored during steady-state, defeating the probe's purpose.

Correct answer: B. Deploy a sidecar container running a proxy (like HAProxy or Socat) that listens on localhost:3306 and forwards traffic to the remote database address.

The Ambassador pattern uses a sidecar to act as a local proxy, making remote services appear local without code changes. Modifying Pod hosts or synchronizing databases adds unnecessary complexity and fails the proxy requirement.

Correct answer: A. Use the 'subPath' field in the volumeMounts section for each file to mount them individually into the target directory.

Using subPath mounts individual files without overwriting the destination directory. However, using a projected volume is also a valid, modern solution for merging multiple volume sources into a single directory.

Correct answer: B. Set the 'fsGroup' field within the Pod's securityContext to 2005 to ensure Kubernetes changes the group ownership of the volume.

Setting fsGroup in the Pod securityContext tells Kubernetes to change the mounted volume's group ownership to that ID. This grants the non-privileged container write access without requiring risky privileged escalations.

Correct answer: A. Update the selector labels in the Service manifest to match the version 2.0 Pod labels

A Kubernetes Service routes traffic using label selectors. Updating the selector to match the new labels instantly shifts all traffic to the Green environment without deploying a new Service or modifying Deployment strategies.

Correct answer: A. Set readOnlyRootFilesystem to true in the securityContext and mount an emptyDir volume at /tmp/app-cache.

Setting readOnlyRootFilesystem to true secures the container image. Mounting an emptyDir at the specific path provides a writable scratch space that remains isolated to the Pod's lifecycle.

Correct answer: B. Apply labels to the namespace that configure the Pod Security Admission controller to enforce the restricted profile

Pod Security Admission is the modern replacement for PodSecurityPolicies. Applying namespace labels like pod-security.kubernetes.io/enforce: restricted automatically enforces the baseline security standard natively.

Correct answer: C. Set the 'terminationGracePeriodSeconds' field in the Pod specification to 60 to allow the application enough time to shut down.

The terminationGracePeriodSeconds defines the duration Kubernetes waits after sending SIGTERM before issuing SIGKILL. Increasing this value ensures the application has the necessary window to finish cleanup tasks safely.

Correct answer: A. Update the selector labels of the 'payment-service' Service to match the labels unique to the Version 2.0 Deployment pods.

Updating the Service selector implements an atomic Blue-Green switch by redirecting internal load balancing to the new Pods. Rolling updates risk mixing traffic, whereas deleting deployments causes downtime.

Correct answer: B. Use a projected volume that includes secret, configMap, and downwardAPI sources.

A projected volume maps several volume sources like Secrets, ConfigMaps, and Downward API into a single directory. This avoids mounting multiple separate volumes and provides a clean, unified filesystem structure.

Correct answer: A. A LivenessProbe configured with an appropriate failureThreshold to trigger a container restart upon repeated failures.

A liveness probe checks if an application is stuck or deadlocked, and failing it triggers the kubelet to restart the container. A readiness probe only routes traffic, meaning a frozen container would stay offline indefinitely without being replaced.

Correct answer: A. Set fsGroup to 5000 in the Pod's securityContext specification

Setting fsGroup to 5000 in the pod security context automatically grants the mounted volume group ownership so your user can read and write files. Running privileged containers or applying broad permissions creates unnecessary security risks on the certification exam.

Correct answer: C. Point the Service selector to a common label shared by both Deployments

A service routes traffic by matching pod labels, so pointing it to a common label shared by both deployments adds them to the pool. The control plane dynamically manages endpoints, making manual edits unreliable and temporary.

Correct answer: A. Set parallelism to 4 and completions to 20 in the Job spec

The parallelism field dictates concurrent worker pods, and completions dictates total successful finishes required. Using activeDeadlineSeconds sets timeout limits rather than concurrency, completely failing to match workload requirements.

Correct answer: A. Use the envFrom field in the container spec and reference the ConfigMap via configMapRef

The envFrom field bulk injects all ConfigMap or Secret keys as environment variables into a container. Mapping individual keys manually using configMapKeyRef is tedious and inefficient for large configurations.

Correct answer: B. Set 'successfulJobsHistoryLimit' to 3 and 'failedJobsHistoryLimit' to 1 in the CronJob spec.

The successfulJobsHistoryLimit and failedJobsHistoryLimit fields restrict how many finished jobs and pods remain for auditing. Configuring ttlSecondsAfterFinished on the job template controls deletion timing rather than strict retention counts.

Correct answer: A. Set the 'startingDeadlineSeconds' field in the CronJob specification to 1800 seconds to define the allowed scheduling window.

Setting startingDeadlineSeconds dictates the grace period before a delayed job is skipped entirely by the controller. The activeDeadlineSeconds field sets the maximum duration a job runs once started, not scheduling delay tolerances.

Correct answer: A. Use an Init container with curl to fetch keys into a shared emptyDir volume

Init containers run sequentially before the main application starts and can share an emptyDir volume. This approach securely passes data to minimal distroless images that lack standard shell utilities. Sidecars run concurrently, making them unsuitable.

Correct answer: B. Configure securityContext with runAsUser 5000 and allowPrivilegeEscalation set to false

Setting runAsUser enforces a specific UID while allowPrivilegeEscalation prevents a process from gaining more privileges than its parent. Configuring these in the security context meets the requirement. PodSecurityPolicy is deprecated and a strong distractor.

Correct answer: C. Set the service property sessionAffinity to ClientIP in the Service manifest.

Setting sessionAffinity to ClientIP ensures requests from a specific IP route to the same pod during the session timeout window. This is the native service configuration for legacy applications. Avoid manual pod selectors or complex Ingress rules.

Correct answer: A. Configure a LivenessProbe using an 'exec' command that runs a custom script to check the status of the internal worker

A liveness probe triggers a container restart when it detects an application deadlock. Using an exec handler allows you to run custom logic that verifies the background worker status directly. Readiness probes only manage traffic routing.

Correct answer: A. Assign the concurrencyPolicy to Forbid to prevent the CronJob controller from starting a new job if the previous instance has not yet finished its execution.

The Forbid policy prevents concurrent executions, ensuring a new job is skipped if the previous one is still running. Replace would terminate the existing job, which violates the requirement to skip the new execution entirely.

Correct answer: C. Create a Service of type ExternalName and set the externalName field to the database DNS name

An ExternalName service creates a CNAME record that maps an internal service name to an external DNS name. While Option C matches the official answer, an ExternalName service technically accepts IP addresses directly in modern Kubernetes clusters.

Correct answer: B. Configure a single Ingress with a host rule and two paths under the paths list

A single Ingress resource can define a host alongside a list of paths, allowing traffic routing to different backend services based on the URL. NodePort or multiple Ingresses are not needed for basic path-based routing.

Correct answer: D. Utilizing a Sidecar container pattern with an emptyDir volume type

The Sidecar pattern is the standard way to extend the main container without modifying its code, and an emptyDir provides temporary shared storage. Other volume types like a PVC would persist data across Pod restarts.

Correct answer: A. Configure 'fsGroup: 1005' in the Pod-level securityContext to change the group ownership of the mounted volume.

Setting fsGroup in the Pod security context automatically changes the group ownership of mounted volumes to the specified ID. This allows the non-root user to write to the storage without requiring privileged access or insecure chmod commands.

Correct answer: C. nginx.ingress.kubernetes.io/rewrite-target: /

The nginx rewrite-target annotation instructs the Ingress controller to replace the matched URL path with the specified value before forwarding the request. The backend-protocol annotation only changes the transport layer and does not alter the URI.

Correct answer: B. Taints on the specialized nodes and Tolerations on the data science Pods

Applying taints to nodes repels all Pods unless they possess a matching toleration. While node selectors help target specific nodes, only taints strictly prevent standard Pods from scheduling there.

Correct answer: C. The Downward API, mapping fieldRef paths like status.podIP and spec.nodeName to environment variables.

The Downward API exposes Pod metadata like IP and Node name directly to containers as environment variables or files. Avoid using init containers or the Kubernetes API for this, as the Downward API provides this data natively without extra RBAC permissions.

Correct answer: D. Define the 'maintenance-page' service as the defaultBackend at the top level of the Ingress resource specification

The defaultBackend field is explicitly designed to handle requests that do not match any defined host or path rules. Using a wildcard path is less reliable because evaluation order and priority can vary between different Ingress controller implementations.

Correct answer: D. Add the NET_ADMIN and NET_RAW capabilities to the capabilities block within the container's securityContext.

Adding capabilities like NET_ADMIN and NET_RAW within the container securityContext grants the exact privileges needed for network tools. Setting privileged to true violates the principle of least privilege by granting all capabilities rather than the specific ones required.

Correct answer: B. Deploy a sidecar container in the same Pod that shares a volume with the main container to read, encrypt, and forward the log data.

Deploying a sidecar container that shares a volume with the main application cleanly separates log encryption from the legacy business logic. The sidecar reads the raw files and securely forwards them, fully adhering to the single container per concern design.

Correct answer: C. The Pod is stuck because Kubernetes requires all Pods in a quota-restricted namespace to have explicit resource requests defined.

When a ResourceQuota restricts CPU or Memory, Kubernetes requires every Pod to explicitly define resource requests so usage can be tracked. Adding explicit requests to the manifest solves this, or a LimitRange could be added to provide defaults.

Correct answer: B. Use an initContainer with the Python image to generate the file into an emptyDir volume shared with the main container

Init containers run to completion before the main application container starts. Sharing an emptyDir volume lets the init container generate the configuration file securely. Sidecars run concurrently, so the app might start before the file exists.

Correct answer: C. Deploy a sidecar container running a specialized proxy that handles the authentication and tunnel, allowing the application to connect via localhost.

The ambassador pattern uses a sidecar proxy to handle complex external connections. Containers in the same pod share the network namespace, allowing the app to connect via localhost. Init containers cannot maintain long-running network tunnels.

Correct answer: B. Define an Egress NetworkPolicy with a CIDR selector for 192.168.1.100/32 and the specific port 5432

An egress network policy whitelists specific destination IP ranges and ports. Creating a rule for the database IP automatically blocks all other non-matching outbound traffic. Ingress rules only control incoming traffic, not outbound.

Correct answer: C. Define a Job with 'completions: 100' and 'parallelism: 5' to manage the execution and retries of the tasks.

A Kubernetes Job handles batch processing tasks by running pods to completion. Setting completions to 100 and parallelism to 5 runs five tasks simultaneously until all finish. Deployments and StatefulSets are for long-running services, not finite tasks.

Correct answer: B. Deploy an adapter container within the same Pod that reads the XML output from a shared volume or standard stream and converts it into the JSON format required by the monitoring platform.

The adapter pattern standardizes output by transforming data within a sidecar container. Reading from a shared volume lets the adapter translate XML logs into the required JSON format. This decouples the legacy app from the monitoring platform.

Correct answer: C. Define a Liveness probe using an HTTP GET check against a health endpoint

A liveness probe checks if an application is responsive and restarts the container if it fails. Since the process is deadlocked but running, only a liveness probe triggers a restart. Readiness probes only remove pods from service endpoints.

Correct answer: B. Use an InitContainer with the migration tool image to run the schema update script before the main container starts.

Init containers run to completion before the main application container starts. If the migration fails, the init container errors out and prevents the main application from starting. PostStart hooks run concurrently with the main app, causing race conditions.

Correct answer: B. An ingress policy with a from section containing both a namespaceSelector matching 'frontend-apps' and a podSelector matching 'app: web-portal'.

A network policy isolates pods by selecting specific sources for traffic. Using both a namespaceSelector and podSelector inside the from block restricts traffic precisely to the frontend pods. Without a namespaceSelector, traffic would be allowed from any namespace.

Correct answer: C. Use secretKeyRef for the environment variable and volumeMounts with subPath for the file

The secretKeyRef correctly targets a specific key for the environment variable, while subPath cleanly mounts just the target file from the ConfigMap. Using envFrom would incorrectly inject all Secret keys, violating the principle of least privilege required for strict configuration.

Correct answer: D. Set maxUnavailable to 0 and maxSurge to a value greater than 0 such as 25%.

Setting maxUnavailable to 0 ensures no healthy pods are terminated during the rollout. The maxSurge setting allows creating extra pods first, whereas setting maxUnavailable higher risks dropping below the required replica capacity.

Correct answer: D. Deploy an Ambassador container that listens for UDP traffic on localhost and proxies it to the external HTTPS endpoint.

An Ambassador container acts as a local proxy representing an external service, handling protocol translation securely. The Adapter pattern modifies outbound data formatting, while a Sidecar typically augments the main container without proxying external connections.

Correct answer: D. Deploy an Ambassador container within the Pod to act as a local proxy for external service discovery and routing.

The Ambassador pattern deploys a local proxy container managing complex external routing for the main app. The Adapter pattern transforms standard application output, whereas Init containers only execute during startup before the app runs.

Correct answer: B. Configure sessionAffinity to ClientIP within the Service manifest specification

Setting sessionAffinity to ClientIP in the Service manifest ensures requests from the same IP reach the same Pod. While Ingress controllers offer external hashing, native Service configuration is the direct Kubernetes way to handle this traffic steering.

Correct answer: C. Add a startupProbe that checks port 8080 and has a sufficient failureThreshold and periodSeconds

A startup probe disables liveness and readiness checks until it succeeds, which is perfect for slow-starting applications. Relying solely on a high liveness probe failure threshold delays deadlock detection after the application finally starts.

Correct answer: C. Configure one Ingress resource with multiple paths under the same host rule

A single Ingress resource can define multiple paths under one host, routing traffic to different backend Services based on the URL. Deploying multiple Ingress controllers is unnecessary and overly complex for simple path-based routing.

Correct answer: B. Add a securityContext to the Pod spec and set the fsGroup field to 3000 to automatically change the ownership of the mounted volume.

Setting fsGroup in the Pod securityContext automatically adjusts mounted volume ownership to match the container's group. Using an init container to change permissions is unnecessarily complex compared to this native Kubernetes feature.

Correct answer: A. A Service of type ExternalName with the AWS FQDN as the value

An ExternalName Service acts as a DNS alias, cleanly mapping an internal Kubernetes name to an external FQDN. Headless Services with manual endpoints are better suited for static IP addresses rather than dynamic cloud FQDNs.

Correct answer: A. Configure a Job with completions set to 20 and parallelism set to 4 to ensure the work is distributed according to the team's performance goals.

Setting completions to 20 ensures all files process, and parallelism dictates running 4 concurrent Pods to handle the workload efficiently. Deployments are designed for long-running services, not batch tasks that exit upon completion.

Correct answer: A. Deploy an Adapter container that reads the XML logs and exports them in JSON

An Adapter container translates the primary application's output into a format the monitoring system expects, standardizing the logs without altering the legacy code. A Sidecar merely forwards raw logs without performing the required translation.

Correct answer: A. Set 'activeDeadlineSeconds' to 1800 in the Job specification (spec) block.

The activeDeadlineSeconds field sets a hard time limit for the entire Job, terminating active Pods once it expires. The ttlSecondsAfterFinished parameter only controls how long a completed Job lingers before automatic deletion.

Correct answer: A. Set the activeDeadlineSeconds field to 2700 in the Job specification.

The activeDeadlineSeconds field sets the absolute duration limit for a Job, terminating its Pods automatically if exceeded. Avoid using livenessProbe for this, as probes check container health rather than total Job execution time.

Correct answer: A. Check the 'Endpoints' object associated with the Service to confirm that it contains the IP addresses of the running Pods.

The Endpoints object tracks which Pod IPs are eligible to receive traffic from a Service. If this list is empty, your Service selector is not matching the Pod labels, which explains the connection failures.

Correct answer: A. Add an annotation such as 'nginx.ingress.kubernetes.io/ssl-redirect: true' to the metadata of the Ingress resource.

Ingress controllers rely on specific metadata annotations to enable features like SSL redirection on a per-resource basis. Changing the backend protocol or Service ports will not configure the controller to issue redirects.

Correct answer: A. Configure the Service with sessionAffinity set to ClientIP to ensure sticky sessions based on the user's IP address

Setting sessionAffinity to ClientIP on a Service ensures requests from the same IP route consistently to the same backing Pod. While Ingress annotations offer cookies, native Service stickiness requires this setting.

Correct answer: C. Set the securityContext 'readOnlyRootFilesystem' to true and mount an 'emptyDir' volume specifically at '/var/app/cache'.

Setting readOnlyRootFilesystem to true secures the container, while an emptyDir volume mount provides the necessary writable scratch space. Never use privileged mode, as it entirely bypasses container security boundaries.

Correct answer: A. A Service of type ClusterIP with a label selector matching the inventory pods, which automatically manages an Endpoints object based on readiness probes.

A ClusterIP Service provides a stable IP and automatically routes traffic only to Pods passing their readiness probes. A Headless Service bypasses this load balancing, returning all Pod IPs directly.

Correct answer: C. Create a Service without a selector, then manually create an Endpoints object with the same name pointing to 192.168.10.50.

Creating a selectorless Service paired with a manually created Endpoints object maps a cluster DNS name to an external IP. An ExternalName Service requires a DNS name, not an IP address.

Correct answer: D. Set 'maxUnavailable' to 2 and 'maxSurge' to 2 within the Deployment's rollingUpdate strategy configuration.

Setting maxUnavailable to 2 guarantees 8 Pods remain running, while maxSurge limits the total to 12 Pods during the update. Option B uses percentages that incorrectly allow 3 unavailable Pods.

Correct answer: A. Set maxUnavailable to 2 and maxSurge to 3 in the deployment strategy

Setting maxUnavailable to 2 ensures at least 10 Pods remain available, while maxSurge limits total running Pods to 15. Options with a maxSurge of 15 or maxUnavailable of 10 violate the stated replica boundaries.

Correct answer: B. Adding a version-specific annotation to the Pod template in the Deployment that changes when the ConfigMap changes

Adding a dynamic annotation, like a config hash, to the Pod template forces a rolling restart when the ConfigMap changes. Kubernetes does not automatically restart Pods when mounted ConfigMap volumes update.

Correct answer: A. Create a NetworkPolicy with an egress rule containing an ipBlock that specifies 203.0.113.10/32 and an empty podSelector for other rules.

Using a default-deny NetworkPolicy with an egress rule for a specific ipBlock perfectly restricts outgoing traffic to the target IP. Ingress resources manage incoming traffic, while ExternalName services merely alias DNS names without restricting outbound network access.

Correct answer: A. Implement an Adapter container that reads the XML output from a shared volume, converts it to JSON, and exposes it.

The adapter pattern standardizes main container output into formats external systems expect by processing shared files locally. An ambassador container proxies external network traffic, while a sidecar is a general term not specific to data translation.

Correct answer: D. Use a Liveness Probe with the grpc field, specifying the port as 9000 and leaving the service field empty or set to the appropriate service name.

Native gRPC probes use the dedicated grpc field allowing the kubelet to properly check application health without extra binaries. A TCP socket probe only verifies the connection, failing to detect deadlocks at the application layer.

Correct answer: A. Configure an ingress rule with both a namespaceSelector and a podSelector as separate items in the same peer element to ensure both conditions must be met.

When you define a namespaceSelector and a podSelector within the same networkPolicyPeer block, they act as a logical AND. Placing them in separate peer blocks would act as an OR, allowing unwanted traffic from any matching pod.

Correct answer: A. Update the selector of the 'api-service' Service to change the 'version' label from 'v1' to 'v2', effectively re-pointing the service to the new pods.

Updating the Service selector is the defining step of a Blue-Green deployment, allowing an instantaneous traffic switch at the networking layer. Changing DNS records or performing a rolling update defeats the purpose of maintaining both deployments for an immediate cutover.

Correct answer: A. Reduce the total requested resources per pod or the replica count to fit within the 2000m CPU and 4Gi Memory limit

The cumulative resource requests of the deployment exceed the namespace quota, causing the scheduler to keep the pods pending. You must lower the requested resources per pod or reduce the replica count to fit within the hard quota limits.

Correct answer: C. Create a NetworkPolicy in the 'accounting' namespace with an ingress rule using a 'namespaceSelector' that matches the 'inventory' namespace labels.

A NetworkPolicy using a namespaceSelector is the correct approach for restricting ingress to a specific namespace. RBAC roles only restrict Kubernetes API access and do not block network traffic between pods.

Correct answer: A. Use a namespaceSelector with matchLabels for the frontend-prod namespace

To restrict traffic to a specific namespace, your NetworkPolicy ingress rule must use a namespaceSelector matching the labels of the target namespace. Standard podSelectors without namespaceSelectors apply only within the same namespace.

Correct answer: B. Increase the memory limit in the Pod specification to accommodate the load

An OOMKilled status indicates the container exceeded its hard memory limit, so increasing the memory limit gives the application the necessary headroom. Pod priority and CPU adjustments do not prevent the kernel from killing a process that exceeds its memory constraints.

Correct answer: A. Use the valueFrom field with configMapKeyRef to map the specific key connection_string from the ConfigMap to the environment variable DATABASE_URL.

The valueFrom field with configMapKeyRef provides explicit one-to-one key mapping for environment variables. This decouples the application's expected variable name from the ConfigMap key. The envFrom field imports all keys without allowing renaming.

Correct answer: C. Set maxUnavailable to 4 units and maxSurge to 25 percent in the strategy block. · D. Set maxUnavailable to 20 percent and maxSurge to 5 units in the strategy block.

Setting maxUnavailable to 4 maintains 16 pods, exactly 80 percent of the desired capacity. Setting maxSurge to 25 percent allows 5 extra pods, reaching the 125 percent maximum limit. Options using percentages incorrectly calculate the available units.

Correct answer: A. Set runAsNonRoot to true and configure a securityContext with readOnlyRootFilesystem set to true, while mounting an emptyDir at /var/log/app/

Setting readOnlyRootFilesystem to true secures the container, and an emptyDir allows necessary application logging. Using a hostPath volume violates security isolation, and resource quotas restrict disk usage but do not prevent root filesystem tampering.